Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-22
- Updated
- 2026-07-30
What it detects
This rule flags process creation where the parent process image contains the PDQDeployRunner naming pattern and the spawned child process matches specific suspicious execution indicators. It matters because PDQDeployRunner can be abused to execute remote commands, including PowerShell-style encoded or hidden download/decode behavior. The detection relies on Windows process creation telemetry, specifically the parent image, child image name/path, and child command line substrings such as -enc/-encodedcommand and web/download/decode functions.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
id: 384093d2-3a62-48e2-ae91-1ab0cf3b05f2
related:
- id: d679950c-abb7-43a6-80fb-2a480c4fc450
type: similar
- id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184
type: derived
status: test
description: This rule flags process creation where the parent process image contains the PDQDeployRunner naming pattern and the spawned child process matches specific suspicious execution indicators. It matters because PDQDeployRunner can be abused to execute remote commands, including PowerShell-style encoded or hidden download/decode behavior. The detection relies on Windows process creation telemetry, specifically the parent image, child image name/path, and child command line substrings such as -enc/-encodedcommand and web/download/decode functions.
references:
- https://twitter.com/malmoeb/status/1550483085472432128
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-22
modified: 2024-05-02
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \PDQDeployRunner-
selection_child:
- Image|endswith:
- \bash.exe
- \certutil.exe
- \cmd.exe
- \csc.exe
- \cscript.exe
- \dllhost.exe
- \mshta.exe
- \msiexec.exe
- \regsvr32.exe
- \rundll32.exe
- \scriptrunner.exe
- \wmic.exe
- \wscript.exe
- \wsl.exe
- Image|contains:
- :\ProgramData\
- :\Users\Public\
- :\Windows\TEMP\
- \AppData\Local\Temp
- CommandLine|contains:
- " -decode "
- " -enc "
- " -encodedcommand "
- " -w hidden"
- DownloadString
- FromBase64String
- http
- "iex "
- Invoke-
condition: all of selection_*
falsepositives:
- Legitimate use of the PDQDeploy tool to execute these commands
level: medium
license: DRL-1.1